{"id":41,"date":"2022-03-30T22:58:59","date_gmt":"2022-03-30T22:58:59","guid":{"rendered":"https:\/\/cyberlorenzo.tech\/?p=41"},"modified":"2022-05-12T22:43:43","modified_gmt":"2022-05-12T22:43:43","slug":"project-one","status":"publish","type":"post","link":"https:\/\/cyberlorenzo.tech\/?p=41","title":{"rendered":"Enumerating and Exploiting SMB (Server Message Block Protocol)"},"content":{"rendered":"\n
\n
\n

<\/h3>\n\n\n\n

https:\/\/tryhackme.com\/<\/a> <\/p>\n<\/div>\n<\/div>\n\n\n\n

What is SMB?<\/strong><\/p>\n\n\n\n

SMB – Server Message Block Protocol – is a client-server communication protocol used for sharing access to files, printers, serial ports and other resources on a network. [source<\/a>]<\/p>\n\n\n\n

Servers make file systems and other resources available to clients on the network. Client computers may have their own hard disks, but they also want access to the shared file systems and printers on the servers.<\/p>\n\n\n\n

The SMB protocol is known as a response-request protocol, meaning that it transmits multiple messages between the client and server to establish a connection. <\/p>\n\n\n\n

Now lets get started!<\/h3>\n\n\n\n

The key tool we will be using in this project will be “Enum4Linux”. This tool is used specifcally for enumerating SMB shares on both Windows and Linux systems. This is installed by default on Parrot or Kali Linux but if you need to install it you can do so from Github. <\/p>\n\n\n\n

https:\/\/github.com\/CiscoCXSecurity\/enum4linux<\/a><\/p>\n\n\n\n

First we need to enumerate to gather some information on our target machine, in the photo provided you can see that we have identified three ports are open using our NMAP scan. [nmap -sV IP]<\/mark><\/code> <\/p>\n\n\n\n

\n
<\/div><\/div>\n<\/div><\/div>\n\n\n\n
\n
\"\"<\/figure>\n<\/figure>\n\n\n\n

We can tell from this scan that SMB is running over ports 139\/445 over TCP<\/p>\n\n\n\n

Now lets run out Enum4Linux command and see if we can sniff a sharelist and any other possible useful information.<\/p>\n\n\n\n

After running the enum4linux -a <\/mark><\/code> command we found out that the workgroup name is “WORKGROUP”. We also learned that the name of the machine is “POLOSMB” and the sharelist populated as well with an interesting directory that we are interested in looking further into called “profiles”. <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\n

There are other vulnerabilities that can actually allow remote code execution by exploiting SMB but it’s said that you are much more likely to find a misconfiguration in the system. In this case we’re doing just that, we’re exploiting anonymous SMB share access which is a common misconfiguration that will lead us to a shell. <\/p>\n<\/div><\/div>\n\n\n\n

\"\"<\/figure>\n\n\n\n

In the photo above you can see we used thesmbclient \/\/[IP]\/profiles<\/mark><\/code> command and we were prompted with a password entry. We used anonymous and were able to get in. Now using the ls command we were able to get a list of directories within the SMB client. <\/p>\n\n\n\n

We took a look around and exfiltrated the “Working From Home Information.txt” file to see what information we could gather. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Looks like we will hit the jackpot if we can figure out John’s login credentials. We can tell from the message that he now has full SSH access into the main server and we have also recovered his first and last name which could be his username or profile folder name. <\/p>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/ What is SMB? SMB – Server Message Block Protocol – is a client-server communication protocol used for sharing access to files, printers, serial ports and other resources on a network. [source] Servers make file systems and other resources available to clients on the network. Client computers may have their own hard disks, but they […]<\/p>\n","protected":false},"author":1,"featured_media":236,"comment_status":"open","ping_status":"open","sticky":false,"template":"templates\/right-sidebar.php","format":"standard","meta":{"saved_in_kubio":false,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-41","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-project-one"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=\/wp\/v2\/posts\/41","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=41"}],"version-history":[{"count":7,"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=\/wp\/v2\/posts\/41\/revisions"}],"predecessor-version":[{"id":138,"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=\/wp\/v2\/posts\/41\/revisions\/138"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=\/wp\/v2\/media\/236"}],"wp:attachment":[{"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberlorenzo.tech\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}